Scientific Linux Security Update : systemd on SL7.x x86_64 (20201001)

Security Fixes : - systemd: memory leak in buttonopen in login/logind-button.c when udev events are received CVE-2019-20386 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141716; scriptversion"1.3";...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20201001)

Security Fixes : - httpd: Improper handling of headers in modsession can allow a remote user to modify session data for CGI applications CVE-2018-1283 - httpd: Out of bounds read in modcachesocache can allow a remote attacker to cause DoS CVE-2018-1303 - httpd: modrewrite configurations vulnerabl...

Scientific Linux Security Update : libvpx on SL7.x x86_64 (20201001)

Security Fixes : - libvpx: Denial of service in mediaserver CVE-2017-0393 - libvpx: Out of bounds read in vp8norm table CVE-2019-9232 - libvpx: Use-after-free in vp8deblock in vp8/common/postproc.c CVE-2019-9433 - libvpx: Out of bounds read in vp8decodeframe in decodeframe.c CVE-2020-0034 C Tenab...

Scientific Linux Security Update : mariadb on SL7.x x86_64 (20201001)

Security Fixes : - mysql: Server: Optimizer unspecified vulnerability CPU Oct 2019 CVE-2019-2974 - mysql: C API unspecified vulnerability CPU Apr 2020 CVE-2020-2752 - mysql: Server: DML unspecified vulnerability CPU Apr 2020 CVE-2020-2780 - mysql: Server: Stored Procedure unspecified vulnerabilit...

Scientific Linux Security Update : unoconv on SL7.x (noarch) (20201001)

Security Fixes : - unoconv: mishandling of pathname leads to SSRF and local file inclusion CVE-2019-17400 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141680; scriptversion"1.3";...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20201001)

Security Fixes : - js-jquery: Cross-site scripting via cross-domain ajax requests CVE-2015-9251 - bootstrap: XSS in the data-target attribute CVE-2016-10735 - bootstrap: Cross-site Scripting XSS in the collapse data-parent attribute CVE-2018-14040 - bootstrap: Cross-site Scripting XSS in the...

Scientific Linux Security Update : exiv2 on SL7.x x86_64 (20201001)

Security Fixes : - exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check CVE-2019-17402 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141707; scriptversion"1.3";...

Scientific Linux Security Update : tigervnc on SL7.x x86_64 (20201001)

Security Fixes : - tigervnc: Stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder CVE-2019-15691 - tigervnc: Heap buffer overflow triggered from CopyRectDecoder due to incorrect value checks CVE-2019-15692 - tigervnc: Heap buffer overflow in TightDecoder::FilterGradient...

Scientific Linux Security Update : freeradius on SL7.x x86_64 (20201001)

Security Fixes : - freeradius: privilege escalation due to insecure logrotate configuration CVE-2019-10143 - freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations CVE-2019-13456 - freeradius: eap-pwd: DoS issues due to multithreaded BNCTX access CVE-2019-17185...

Scientific Linux Security Update : librabbitmq on SL7.x x86_64 (20201001)

Security Fixes : - librabbitmq: integer overflow in amqphandleinput in amqpconnection.c leads to heap-based buffer overflow CVE-2019-18609 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141652; scriptversion"1.3";...

Scientific Linux Security Update : python on SL7.x x86_64 (20201001)

Security Fixes : - python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141713; scriptversion"1.3";...

Scientific Linux Security Update : curl on SL7.x x86_64 (20201001)

Security Fixes : - curl: heap buffer overflow in function tftpreceivepacket CVE-2019-5482 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141681; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : python3 on SL7.x x86_64 (20201001)

Security Fixes : - python: XSS vulnerability in the documentation XML-RPC server in servertitle field CVE-2019-16935 - python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS CVE-2020-8492 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : mod_auth_openidc on SL7.x x86_64 (20201001)

Security Fixes : - modauthopenidc: Open redirect in logout url when using URLs with leading slashes CVE-2019-14857 - modauthopenidc: Open redirect issue exists in URLs with slash and backslash CVE-2019-20479 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : glib2 and ibus on SL7.x x86_64 (20201001)

Security Fixes : - glib2: filecopyfallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress CVE-2019-12450 - ibus: missing authorization allows local attacker to access the input bus of another user CVE-2019-14822 C Tenable Network...

Scientific Linux Security Update : bluez on SL7.x x86_64 (20201001)

Security Fixes : - bluez: Improper access control in subsystem could result in privilege escalation and DoS CVE-2020-0556 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141686; scriptversion"1.3";...

Scientific Linux Security Update : SDL on SL7.x x86_64 (20201001)

Security Fixes : - SDL: buffer over-read in IMAADPCMnibble in audio/SDLwave.c CVE-2019-7572 - SDL: heap-based buffer overflow in function MSADPCMdecode in audio/SDLwave.c CVE-2019-7575 - SDL: heap-based buffer over-read in SDLGetRGB in video/SDLpixels.c CVE-2019-7636 - SDL: heap-based buffer...

Scientific Linux Security Update : cups on SL7.x x86_64 (20201001)

Security Fixes : - cups: DNS rebinding attacks via incorrect whitelist CVE-2017-18190 - cups: stack-buffer-overflow in libcups's asn1gettype function CVE-2019-8675 - cups: stack-buffer-overflow in libcups's asn1getpacked function CVE-2019-8696 C Tenable Network Security, Inc. The descriptive text...

Scientific Linux Security Update : libtiff on SL7.x x86_64 (20201001)

Security Fixes : - libtiff: integer overflow in TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c CVE-2019-14973 - libtiff: integer overflow leading to heap-based buffer overflow in tifgetimage.c CVE-2019-17546 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : pcp on SL7.x x86_64 (20201001)

Security Fixes : - pcp: Local privilege escalation in pcp spec file %post section CVE-2019-3695 - pcp: Local privilege escalation in pcp spec file through migratetempdirs CVE-2019-3696 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...